better-auth 1.7.5 → 1.7.7

package/dist/plugins/admin/admin.mjs

@@ -42,8 +42,10 @@ const admin = (options) => {
 							});
 							return;
 						}
+						const bannedUserMessage = opts.bannedUserMessage;
+						const message = typeof bannedUserMessage === "function" ? await bannedUserMessage(user) : bannedUserMessage;
 						throw APIError.from("FORBIDDEN", {
-							message: opts.bannedUserMessage,
+							message,
 							code: "BANNED_USER"
 						});
 					}

package/dist/plugins/admin/routes.mjs

@@ -2,6 +2,7 @@ import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
 import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermission } from "./has-permission.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -190,6 +191,7 @@ const createUser = (opts) => createAuthEndpoint("/admin/create-user", {
 	}
 	const email = ctx.body.email.toLowerCase();
 	if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
+	if (ctx.body.password) assertPasswordNotTooLong(ctx, ctx.body.password);
 	if (await ctx.context.internalAdapter.findUserByEmail(email)) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);
 	const user = await ctx.context.internalAdapter.createUser({
 		...userData,
@@ -823,16 +825,8 @@ const setUserPassword = (opts) => createAuthEndpoint("/admin/set-user-password",
 		permissions: { user: ["set-password"] }
 	})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD);
 	const { newPassword, userId } = ctx.body;
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (newPassword.length < minPasswordLength) {
-		ctx.context.logger.warn("Password is too short");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	}
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (newPassword.length > maxPasswordLength) {
-		ctx.context.logger.warn("Password is too long");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
-	}
+	assertPasswordNotTooShort(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, newPassword);
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	if (!user) throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const hashedPassword = await ctx.context.password.hash(newPassword);

package/dist/plugins/admin/types.d.mts

@@ -2,6 +2,7 @@ import { Session, User } from "../../types/models.mjs";
 import { InferOptionSchema } from "../../types/plugins.mjs";
 import { AccessControl, Role } from "../access/types.mjs";
 import { AdminSchema } from "./schema.mjs";
+import { Awaitable } from "@better-auth/core";
 
 //#region src/plugins/admin/types.d.ts
 interface UserWithRole extends User {
@@ -70,8 +71,10 @@ interface AdminOptions {
    * Message to show when a user is banned
    *
    * By default, the message is "You have been banned from this application"
+   *
+   * Can also be a function that receives the banned user and returns a message.
    */
-  bannedUserMessage?: string | undefined;
+  bannedUserMessage?: string | ((user: UserWithRole & Record<string, unknown>) => Awaitable<string>) | undefined;
   /**
    * Whether to allow impersonating other admins.
    *

package/dist/plugins/captcha/constants.d.mts

@@ -4,6 +4,7 @@ declare const Providers: {
   readonly GOOGLE_RECAPTCHA: "google-recaptcha";
   readonly HCAPTCHA: "hcaptcha";
   readonly CAPTCHAFOX: "captchafox";
+  readonly VERCEL_BOTID: "vercel-botid";
 };
 //#endregion
 export { Providers };

package/dist/plugins/captcha/constants.mjs

@@ -15,7 +15,8 @@ const Providers = {
 	CLOUDFLARE_TURNSTILE: "cloudflare-turnstile",
 	GOOGLE_RECAPTCHA: "google-recaptcha",
 	HCAPTCHA: "hcaptcha",
-	CAPTCHAFOX: "captchafox"
+	CAPTCHAFOX: "captchafox",
+	VERCEL_BOTID: "vercel-botid"
 };
 const siteVerifyMap = {
 	[Providers.CLOUDFLARE_TURNSTILE]: "https://challenges.cloudflare.com/turnstile/v0/siteverify",

package/dist/plugins/captcha/index.d.mts

@@ -1,4 +1,4 @@
-import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./types.mjs";
+import { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions } from "./types.mjs";
 import * as _$_better_auth_core0 from "@better-auth/core";
 import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
 
@@ -24,4 +24,4 @@ declare const captcha: (options: CaptchaOptions) => {
   options: CaptchaOptions;
 };
 //#endregion
-export { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, captcha };
+export { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions, captcha };

package/dist/plugins/captcha/index.mjs

@@ -7,6 +7,7 @@ import { captchaFox } from "./verify-handlers/captchafox.mjs";
 import { cloudflareTurnstile } from "./verify-handlers/cloudflare-turnstile.mjs";
 import { googleRecaptcha } from "./verify-handlers/google-recaptcha.mjs";
 import { hCaptcha } from "./verify-handlers/h-captcha.mjs";
+import { vercelBotId } from "./verify-handlers/vercel-botid.mjs";
 import { getIP } from "@better-auth/core/utils/ip";
 //#region src/plugins/captcha/index.ts
 const normalizeEndpointPath = (pathname, basePath) => {
@@ -26,6 +27,11 @@ const captcha = (options) => ({
 			const basePath = ctx.options.basePath ?? "/api/auth";
 			const pathname = normalizeEndpointPath(url.pathname, basePath);
 			if (!endpoints.some((endpoint) => endpoint.includes("*") ? wildcardMatch(endpoint)(pathname) : endpoint === pathname)) return;
+			if (options.provider === Providers.VERCEL_BOTID) return await vercelBotId({
+				request,
+				checkBotId: options.checkBotId,
+				validateRequest: options.validateRequest
+			});
 			if (!options.secretKey) throw new Error(INTERNAL_ERROR_CODES.MISSING_SECRET_KEY.message);
 			const captchaResponse = request.headers.get("x-captcha-response");
 			const remoteUserIP = getIP(request, ctx.options) ?? void 0;

package/dist/plugins/captcha/types.d.mts

@@ -47,6 +47,48 @@ interface CaptchaFoxOptions extends BaseCaptchaOptions {
   provider: typeof Providers.CAPTCHAFOX;
   siteKey?: string | undefined;
 }
-type CaptchaOptions = GoogleRecaptchaOptions | CloudflareTurnstileOptions | HCaptchaOptions | CaptchaFoxOptions;
+/**
+ * BotID verdict fields available to custom request validation.
+ *
+ * @see https://vercel.com/docs/botid/verified-bots
+ */
+type BotIdVerification = {
+  isBot: boolean;
+  isVerifiedBot?: boolean | undefined;
+  verifiedBotName?: string | undefined;
+  verifiedBotCategory?: string | undefined;
+};
+type ValidateRequestContext = {
+  request: Request;
+  verification: BotIdVerification;
+};
+/**
+ * Protect auth requests with Vercel BotID. The browser must also protect the
+ * same request paths and methods with BotID's client SDK.
+ *
+ * @see https://vercel.com/docs/botid/get-started
+ */
+interface VercelBotIdOptions {
+  provider: typeof Providers.VERCEL_BOTID;
+  /**
+   * Auth paths to verify, without the Better Auth base path.
+   *
+   * @default ["/sign-up/email", "/sign-in/email", "/request-password-reset"]
+   */
+  endpoints?: string[] | undefined;
+  /**
+   * Vercel's server-side check for the current request. Pass `checkBotId` from
+   * `botid/server`, or wrap it to supply SDK options.
+   */
+  checkBotId: () => Promise<BotIdVerification>;
+  /**
+   * Override the default `isBot === false` decision. Return `true` to allow
+   * the request, including a verified bot you trust.
+   *
+   * @see https://vercel.com/docs/botid/verified-bots
+   */
+  validateRequest?: (ctx: ValidateRequestContext) => boolean | Promise<boolean>;
+}
+type CaptchaOptions = GoogleRecaptchaOptions | CloudflareTurnstileOptions | HCaptchaOptions | CaptchaFoxOptions | VercelBotIdOptions;
 //#endregion
-export { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider };
+export { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions };

package/dist/plugins/captcha/utils.mjs

@@ -5,5 +5,15 @@ const encodeToURLParams = (obj) => {
 	for (const [key, value] of Object.entries(obj)) if (value !== void 0 && value !== null) params.append(key, String(value));
 	return params.toString();
 };
+/**
+* Rejects after `timeoutMs` without cancelling the underlying promise.
+*/
+const withTimeout = (promise, timeoutMs) => {
+	let timer;
+	const timeout = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error("Operation timed out")), timeoutMs);
+	});
+	return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+};
 //#endregion
-export { encodeToURLParams };
+export { encodeToURLParams, withTimeout };

package/dist/plugins/captcha/verify-handlers/vercel-botid.mjs

@@ -0,0 +1,27 @@
+import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
+import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
+import { withTimeout } from "../utils.mjs";
+//#region src/plugins/captcha/verify-handlers/vercel-botid.ts
+const vercelBotId = async ({ request, checkBotId, validateRequest }) => {
+	let isValid;
+	try {
+		isValid = await withTimeout((async () => {
+			const verification = await checkBotId();
+			return validateRequest ? validateRequest({
+				request,
+				verification
+			}) : verification.isBot === false;
+		})(), CAPTCHA_VERIFY_TIMEOUT_MS);
+	} catch (error) {
+		throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message, { cause: error });
+	}
+	if (isValid) return void 0;
+	return middlewareResponse({
+		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
+		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
+		status: 403
+	});
+};
+//#endregion
+export { vercelBotId };

package/dist/plugins/email-otp/routes.mjs

@@ -6,6 +6,7 @@ import { symmetricDecrypt } from "../../crypto/index.mjs";
 import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
 import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
 import { splitAtLastColon, toOTPIdentifier } from "./utils.mjs";
@@ -581,10 +582,8 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	} }
 }, async (ctx) => {
 	const email = ctx.body.email.toLowerCase();
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (ctx.body.password.length < minPasswordLength) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (ctx.body.password.length > maxPasswordLength) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	assertPasswordNotTooShort(ctx, ctx.body.password);
+	assertPasswordNotTooLong(ctx, ctx.body.password);
 	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("forget-password", email), ctx.body.otp);
 	const user = await ctx.context.internalAdapter.findUserByEmail(email);
 	if (!user) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);

package/dist/plugins/index.d.mts

@@ -10,7 +10,7 @@ import { admin } from "./admin/admin.mjs";
 import { AnonymousOptions, AnonymousSession, UserWithAnonymous } from "./anonymous/types.mjs";
 import { anonymous } from "./anonymous/index.mjs";
 import { BearerOptions, bearer } from "./bearer/index.mjs";
-import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./captcha/types.mjs";
+import { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions } from "./captcha/types.mjs";
 import { captcha } from "./captcha/index.mjs";
 import { CustomSessionPluginOptions, customSession } from "./custom-session/index.mjs";
 import { TimeString, ms, sec } from "../utils/time.mjs";
@@ -66,4 +66,4 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };
+export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, ValidateRequestContext, VercelBotIdOptions, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };

package/dist/plugins/magic-link/index.mjs

@@ -23,6 +23,20 @@ const magicLinkVerifyQuerySchema = z.object({
 	errorCallbackURL: z.string().meta({ description: "URL to redirect after error." }).optional(),
 	newUserCallbackURL: z.string().meta({ description: "URL to redirect after new user signup. Only used if the user is registering for the first time." }).optional()
 });
+const magicLinkRecordSchema = z.object({
+	type: z.literal("magic-link"),
+	email: z.email(),
+	name: z.string().optional()
+}).strict();
+function parseMagicLinkRecord(value) {
+	try {
+		const parsed = JSON.parse(value);
+		return magicLinkRecordSchema.safeParse(parsed);
+	} catch {
+		return null;
+	}
+}
+const magicLinkIdentifier = (storedToken) => `magic-link:${storedToken}`;
 const magicLink = (options) => {
 	const opts = {
 		storeToken: "plain",
@@ -75,8 +89,9 @@ const magicLink = (options) => {
 				const verificationToken = opts?.generateToken ? await opts.generateToken(email) : generateRandomString(32, "a-z", "A-Z");
 				const storedToken = await storeToken(ctx, verificationToken);
 				await ctx.context.internalAdapter.createVerificationValue({
-					identifier: storedToken,
+					identifier: magicLinkIdentifier(storedToken),
 					value: JSON.stringify({
+						type: "magic-link",
 						email,
 						name: ctx.body.name
 					}),
@@ -152,10 +167,14 @@ const magicLink = (options) => {
 					throw ctx.redirect(errorCallbackURL.toString());
 				}
 				const newUserCallbackURL = new URL(ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : callbackURL, ctx.context.baseURL).toString();
-				const storedToken = await storeToken(ctx, token);
-				const tokenValue = await ctx.context.internalAdapter.consumeVerificationValue(storedToken);
+				const identifier = magicLinkIdentifier(await storeToken(ctx, token));
+				const pendingValue = await ctx.context.internalAdapter.findVerificationValue(identifier);
+				if (!pendingValue || !parseMagicLinkRecord(pendingValue.value)?.success) redirectWithError("INVALID_TOKEN");
+				const tokenValue = await ctx.context.internalAdapter.consumeVerificationValue(identifier);
 				if (!tokenValue) redirectWithError("INVALID_TOKEN");
-				const { email, name } = JSON.parse(tokenValue.value);
+				const record = parseMagicLinkRecord(tokenValue.value);
+				if (!record?.success) redirectWithError("INVALID_TOKEN");
+				const { email, name } = record.data;
 				let isNewUser = false;
 				let user = await ctx.context.internalAdapter.findUserByEmail(email).then((res) => res?.user);
 				if (!user) if (!opts.disableSignUp) {

package/dist/plugins/oauth-proxy/index.d.mts

@@ -41,12 +41,11 @@ interface OAuthProxyOptions {
    * A dedicated secret used to encrypt and decrypt data passed between
    * servers during the OAuth proxy flow.
    *
-   * When set, this secret is used **instead of** the global
-   * `BETTER_AUTH_SECRET` for all OAuth proxy encryption operations.
-   * This limits the blast radius if the secret is shared across
-   * environments (production, preview, development): a leaked proxy
-   * secret cannot be used to forge sessions or decrypt other data
-   * protected by the main secret.
+   * When set, keys derived from this secret are used **instead of** keys
+   * derived from `BETTER_AUTH_SECRET` for OAuth proxy encryption.
+   * This limits exposure of data protected only by the main secret if
+   * the proxy secret is shared across environments (production, preview,
+   * development). A compromised proxy secret can still affect OAuth flows.
    *
    * All environments participating in the OAuth proxy flow must share
    * the same `secret` value.

package/dist/plugins/oauth-proxy/index.mjs

@@ -7,9 +7,10 @@ import { setSessionCookie } from "../../cookies/index.mjs";
 import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { redirectOnError } from "../../oauth2/errors.mjs";
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
-import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { setOAuthState } from "../../api/state/oauth.mjs";
-import { parseGenericState } from "../../state.mjs";
+import { derivePurposeKey } from "../../crypto/purpose.mjs";
+import { getAuthStateVerificationIdentifier, parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
@@ -37,6 +38,7 @@ const passthroughPayloadSchema = z.looseObject({
 		updatedAt: true
 	}).shape),
 	profile: z.record(z.string(), z.unknown()).optional(),
+	scopes: z.array(z.string()).optional(),
 	state: z.string().min(1),
 	callbackURL: z.string().min(1),
 	newUserURL: z.string().optional(),
@@ -65,7 +67,7 @@ const oauthCallbackQuerySchema = z.object({
 });
 const oAuthProxy = (opts) => {
 	const maxAge = opts?.maxAge ?? 60;
-	const getEncryptionKey = (ctx) => opts?.secret ?? ctx.context.secretConfig;
+	const getEncryptionKey = (ctx, purpose) => derivePurposeKey(opts?.secret ?? ctx.context.secretConfig, purpose);
 	const oauthProxyCompletion = createAuthEndpoint("/callback/:id/oauth-proxy", {
 		method: "GET",
 		operationId: "oauthProxyCompletion",
@@ -83,7 +85,7 @@ const oAuthProxy = (opts) => {
 		let decryptedPayload;
 		try {
 			decryptedPayload = await symmetricDecrypt({
-				key: getEncryptionKey(ctx),
+				key: getEncryptionKey(ctx, "oauth-proxy-profile"),
 				data: encryptedProfile
 			});
 		} catch (e) {
@@ -107,7 +109,19 @@ const oAuthProxy = (opts) => {
 			ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
 			throw redirectOnError(ctx, errorURL, "payload_expired");
 		}
-		if (!await restoreOAuthProxyState(ctx, payload.state)) throw redirectOnError(ctx, errorURL, "state_mismatch");
+		const stateData = await restoreOAuthProxyState(ctx, payload.state);
+		if (!stateData) throw redirectOnError(ctx, errorURL, "state_mismatch");
+		if (stateData.link) {
+			const linkResult = await linkOAuthAccount(ctx, {
+				link: stateData.link,
+				userInfo: payload.userInfo,
+				account: payload.account,
+				profile: payload.profile ?? {},
+				scopes: payload.scopes ?? payload.account.scope?.split(",")
+			});
+			if (!linkResult.linked) throw redirectOnError(ctx, errorURL, linkResult.error.code, linkResult.error.message);
+			throw ctx.redirect(payload.callbackURL);
+		}
 		let result;
 		try {
 			result = await handleOAuthUserInfo(ctx, {
@@ -185,7 +199,7 @@ const oAuthProxy = (opts) => {
 		hooks: {
 			before: [{
 				matcher(context) {
-					return !!context.path?.startsWith("/sign-in/social");
+					return !!context.path?.startsWith("/sign-in/social") || context.path === "/link-social";
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					if (checkSkipProxy(ctx, opts)) return;
@@ -212,7 +226,7 @@ const oAuthProxy = (opts) => {
 					let statePackage;
 					try {
 						statePackage = parseJSON(await symmetricDecrypt({
-							key: getEncryptionKey(ctx),
+							key: getEncryptionKey(ctx, "oauth-proxy-package"),
 							data: state
 						}));
 					} catch {
@@ -232,7 +246,7 @@ const oAuthProxy = (opts) => {
 					let stateData;
 					try {
 						stateData = parseJSON(await symmetricDecrypt({
-							key: getEncryptionKey(ctx),
+							key: getEncryptionKey(ctx, "oauth-proxy-state"),
 							data: statePackage.stateCookie
 						}));
 					} catch (e) {
@@ -307,6 +321,7 @@ const oAuthProxy = (opts) => {
 							emailVerified: userInfo.emailVerified
 						},
 						profile: providerProfile,
+						scopes: tokens.scopes,
 						account: {
 							...accountKey,
 							accessToken: tokens.accessToken,
@@ -324,7 +339,7 @@ const oAuthProxy = (opts) => {
 						timestamp: Date.now()
 					};
 					const encryptedPayload = await symmetricEncrypt({
-						key: getEncryptionKey(ctx),
+						key: getEncryptionKey(ctx, "oauth-proxy-profile"),
 						data: JSON.stringify(payload)
 					});
 					proxyCallbackURL.searchParams.set("profile", encryptedPayload);
@@ -333,14 +348,14 @@ const oAuthProxy = (opts) => {
 			}],
 			after: [{
 				matcher(context) {
-					return !!context.path?.startsWith("/sign-in/social");
+					return !!context.path?.startsWith("/sign-in/social") || context.path === "/link-social";
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					if (checkSkipProxy(ctx, opts)) return;
 					const signInResponse = ctx.context.returned;
 					if (!signInResponse || typeof signInResponse !== "object" || !("url" in signInResponse)) return;
 					const { url: providerURL } = signInResponse;
-					if (typeof providerURL !== "string") return;
+					if (typeof providerURL !== "string" || providerURL.length === 0) return;
 					const oauthURL = new URL(providerURL);
 					const originalState = oauthURL.searchParams.get("state");
 					if (!originalState) return;
@@ -352,11 +367,11 @@ const oAuthProxy = (opts) => {
 								const oauthStateCookie = ctx.context.createAuthCookie("oauth_state");
 								const encryptedCookieValue = parseSetCookieHeader(setCookieHeader).get(oauthStateCookie.name)?.value;
 								if (encryptedCookieValue) plaintextState = await symmetricDecrypt({
-									key: ctx.context.secretConfig,
+									key: derivePurposeKey(ctx.context.secretConfig, "oauth-state-cookie"),
 									data: encryptedCookieValue
 								});
 							}
-						} else plaintextState = (await ctx.context.internalAdapter.findVerificationValue(originalState))?.value;
+						} else plaintextState = (await ctx.context.internalAdapter.findVerificationValue(getAuthStateVerificationIdentifier(originalState)))?.value;
 						if (!plaintextState) {
 							ctx.context.logger.warn("No OAuth state found for proxy");
 							return;
@@ -364,13 +379,13 @@ const oAuthProxy = (opts) => {
 						const statePackage = {
 							state: originalState,
 							stateCookie: await symmetricEncrypt({
-								key: getEncryptionKey(ctx),
+								key: getEncryptionKey(ctx, "oauth-proxy-state"),
 								data: plaintextState
 							}),
 							isOAuthProxy: true
 						};
 						const encryptedPackage = await symmetricEncrypt({
-							key: getEncryptionKey(ctx),
+							key: getEncryptionKey(ctx, "oauth-proxy-package"),
 							data: JSON.stringify(statePackage)
 						});
 						oauthURL.searchParams.set("state", encryptedPackage);

package/dist/plugins/open-api/index.mjs

@@ -1,4 +1,5 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import "../../utils/index.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { generator } from "./generator.mjs";

package/dist/plugins/organization/client.mjs

@@ -1,5 +1,6 @@
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { useAuthQuery } from "../../client/query.mjs";
+import { matchesSessionSignal } from "../../client/config.mjs";
 import { adminAc, defaultRoles, memberAc, ownerAc } from "./access/statement.mjs";
 import { ORGANIZATION_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermissionFn } from "./permission.mjs";
@@ -71,7 +72,7 @@ const organizationClient = (options) => {
 			},
 			{
 				matcher(path) {
-					return path === "/sign-out" || path.startsWith("/organization");
+					return matchesSessionSignal(path) || path.startsWith("/organization");
 				},
 				signal: "$activeOrgSignal"
 			},

package/dist/plugins/phone-number/routes.mjs

@@ -4,6 +4,8 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
+import "../../utils/index.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -54,6 +56,7 @@ const signInPhoneNumber = (opts) => createAuthEndpoint("/sign-in/phone-number",
 	if (opts.phoneNumberValidator) {
 		if (!await opts.phoneNumberValidator(ctx.body.phoneNumber)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_PHONE_NUMBER);
 	}
+	assertPasswordNotTooLong(ctx, password);
 	const user = await ctx.context.adapter.findOne({
 		model: "user",
 		where: [{
@@ -466,10 +469,8 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		}]
 	});
 	if (!user) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.UNEXPECTED_ERROR);
-	const minLength = ctx.context.password.config.minPasswordLength;
-	const maxLength = ctx.context.password.config.maxPasswordLength;
-	if (ctx.body.newPassword.length < minLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	if (ctx.body.newPassword.length > maxLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
+	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
 	const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
 	if (!await ctx.context.internalAdapter.findCredentialAccount(user.id)) await ctx.context.internalAdapter.createAccount({
 		userId: user.id,

package/dist/plugins/username/index.mjs

@@ -2,6 +2,7 @@ import { mergeSchema, parseUserOutput } from "../../db/schema.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { createEmailVerificationToken } from "../../api/routes/email-verification.mjs";
+import { assertPasswordNotTooLong } from "../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { USERNAME_ERROR_CODES } from "./error-codes.mjs";
 import { getSchema } from "./schema.mjs";
@@ -166,6 +167,7 @@ const usernameImpl = (options, includeDisplayUsername) => {
 					throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.USERNAME_TOO_LONG);
 				}
 				if (!await (options?.usernameValidator || defaultUsernameValidator)(username)) throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.INVALID_USERNAME);
+				assertPasswordNotTooLong(ctx, ctx.body.password);
 				const user = await ctx.context.adapter.findOne({
 					model: "user",
 					where: [{

package/dist/state.mjs

@@ -1,6 +1,7 @@
 import { generateRandomString } from "./crypto/random.mjs";
 import { symmetricDecrypt, symmetricEncrypt } from "./crypto/index.mjs";
 import { expireCookie } from "./cookies/index.mjs";
+import { derivePurposeKey } from "./crypto/purpose.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import * as z from "zod";
 //#region src/state.ts
@@ -32,6 +33,8 @@ const stateDataSchema = z.looseObject({
 	*/
 	serverContext: z.record(z.string(), z.unknown()).optional()
 });
+/** Verification key for database-backed OAuth and SAML relay state. */
+const getAuthStateVerificationIdentifier = (state) => `auth-state:${state}`;
 const INTERNAL_STATE_KEYS = new Set(Object.keys(stateDataSchema.shape));
 var StateError = class extends BetterAuthError {
 	code;
@@ -59,7 +62,7 @@ async function generateGenericState(c, stateData, settings) {
 			oauthState: state
 		};
 		const encryptedData = await symmetricEncrypt({
-			key: c.context.secretConfig,
+			key: derivePurposeKey(c.context.secretConfig, "oauth-state-cookie"),
 			data: JSON.stringify(payload)
 		});
 		const stateCookie = c.context.createAuthCookie(settings?.cookieName ?? "oauth_state", { maxAge: 600 });
@@ -78,7 +81,7 @@ async function generateGenericState(c, stateData, settings) {
 			...stateData,
 			oauthState: state
 		}),
-		identifier: state,
+		identifier: getAuthStateVerificationIdentifier(state),
 		expiresAt
 	})) throw new StateError("Unable to create verification. Make sure the database adapter is properly working and there is a verification table in the database", { code: "state_generation_error" });
 	return {
@@ -99,7 +102,7 @@ async function parseGenericState(c, state, settings) {
 		});
 		try {
 			const decryptedData = await symmetricDecrypt({
-				key: c.context.secretConfig,
+				key: derivePurposeKey(c.context.secretConfig, "oauth-state-cookie"),
 				data: encryptedData
 			});
 			parsedData = stateDataSchema.parse(JSON.parse(decryptedData));
@@ -117,7 +120,7 @@ async function parseGenericState(c, state, settings) {
 		});
 		expireCookie(c, stateCookie);
 	} else {
-		const data = await c.context.internalAdapter.findVerificationValue(state);
+		const data = await c.context.internalAdapter.findVerificationValue(getAuthStateVerificationIdentifier(state));
 		if (!data) throw new StateError("State mismatch: verification not found", {
 			code: "state_mismatch",
 			details: { state }
@@ -136,7 +139,7 @@ async function parseGenericState(c, state, settings) {
 			errorURL: parsedData.errorURL
 		});
 		expireCookie(c, stateCookie);
-		await c.context.internalAdapter.deleteVerificationByIdentifier(state);
+		await c.context.internalAdapter.deleteVerificationByIdentifier(getAuthStateVerificationIdentifier(state));
 	}
 	if (parsedData.expiresAt < Date.now()) throw new StateError("Invalid state: request expired", {
 		code: "state_mismatch",
@@ -146,4 +149,4 @@ async function parseGenericState(c, state, settings) {
 	return parsedData;
 }
 //#endregion
-export { INTERNAL_STATE_KEYS, StateError, generateGenericState, parseGenericState };
+export { INTERNAL_STATE_KEYS, StateError, generateGenericState, getAuthStateVerificationIdentifier, parseGenericState };

package/dist/utils/hashing.mjs

@@ -1,5 +1,5 @@
-import { keccak_256 } from "@noble/hashes/sha3.js";
 import { utf8ToBytes } from "@noble/hashes/utils.js";
+import { keccak_256 } from "@noble/hashes/sha3.js";
 //#region src/utils/hashing.ts
 /**
 * TS implementation of ERC-55 ("Mixed-case checksum address encoding") using @noble/hashes

package/dist/utils/index.mjs

@@ -0,0 +1,5 @@
+import "./url.mjs";
+import "../state.mjs";
+import "../oauth2/state.mjs";
+import "./hide-metadata.mjs";
+export {};